In a phishing attack, an individual (e.g., a person, an employee of a company, a user of a computing device) receives a message, commonly in the form of an e-mail or other electronic communication, directing the individual to perform an action, such as opening an e-mail attachment or following (e.g., using a cursor controlled device or touch screen) an embedded link. If such message were from a trusted source (e.g., co-worker, bank, utility company or other well-known and trusted entity), such action might carry little risk. Nevertheless, in a phishing attack, such message is from an attacker (e.g., an individual using a computing device to perform a malicious act on another computer device user) disguised as a trusted source, and an unsuspecting individual, for example, opening an attachment to view a “friend's photograph” might in fact install spyware, a virus, and/or other malware (i.e., malicious computer software) on his/her computer. Similarly, an unsuspecting individual directed to a webpage made to look like an official banking webpage might be deceived into submitting his/her username, password, banking account number, etc. to an attacker.
While there are computer programs designed to detect and block phishing e-mails, phishing attacks methods are constantly being modified by attackers to evade such forms of detection. More recently, training programs have been developed to train users to recognize phishing attacks, such training involving simulated phishing attacks. While such training is beneficial, training programs may accumulate certain information about the users, which, if exploited by an attacker (e.g., attacker were able to gain access to same), could cause great harm to the participants of the training programs. The present invention addresses such potential vulnerabilities of training programs.